dip your toes in the sea of security (php dorset, 2nd june 2014)

Dip Your Toesin the Sea of Security

James TitcumbPHP Dorset

2nd June 2014

James Titcumbwww.jamestitcumb.comwww.protected.co.ukwww.phphants.co.uk@asgrim

Who is this guy?

Who are you?

https://www.flickr.com/photos/akrabat/10168019755/

Some simple code...

<?php

$a = (int)$_GET['a'];

$b = (int)$_GET['b'];

$result = $a + $b;

printf('The answer is %d', $result);

The Golden Rules

The Golden Rules

1. Keep it simple

The Golden Rules

1. Keep it simple2. Know the risks

The Golden Rules

1. Keep it simple2. Know the risks3. Fail securely

The Golden Rules

1. Keep it simple2. Know the risks3. Fail securely4. Don’t reinvent the wheel

The Golden Rules

1. Keep it simple2. Know the risks3. Fail securely4. Don’t reinvent the wheel5. Never trust anything / anyone

OWASP& the OWASP Top 10

https://www.owasp.org/

Application Security(mainly PHP applications)

Always remember…

Filter InputEscape Output

SQL Injection (#1)

http://xkcd.com/327/

SQL Injection (#1)

1. Use PDO / mysqli2. Use prepared / parameterized statements

SQL Injection (#1)<?php

$user_id = $_GET['user_id'];

$sql = "

SELECT * FROM users

WHERE user_id = {$user_id}";

$db->execute($sql); ✘

SQL Injection (#1)<?php

$user_id = $_GET['user_id'];

$sql = "

SELECT * FROM users

WHERE user_id = :userid";

$stmt = $db->prepare($sql);

$stmt->bind('userid', $user_id);

$stmt->execute();✔

Cross-Site Scripting / XSS (#3)

● Escape output

Cross-Site Scripting / XSS (#3)

● Escape output<?php

$unfilteredInput = '<script type="text/javascript">...</script>';

// Unescaped - JS will run :'(

echo $unfilteredInput;

// Escaped - JS will not run :)

echo htmlspecialchars($string, ENT_QUOTES, 'UTF-8');

Cross-Site Request Forgery / CSRF (#8)

● HTTP request● e.g. submit a POST request to login form

Errors, Exceptions & Logging (#6)

Sensitive Information exposurecustom Exception & Error handling - filter what the end user sees - Handle API responses in a unified way

curl + https<?php

curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

✘

curl + https<?php

curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);

curl_setopt($ch, CURLOPT_CAINFO, "/path/to/certificate");

✔

exec($_GET)https://github.com/search?q=exec%28%24_GET&ref=cmdform&type=Code

eval()https://github.com/search?q=eval%28%24_GET&type=Code&ref=searchresults

WordPress

WordPress

Urgh.

We are not security experts!

We CAN write secure code

We are not security experts!

We CAN write secure code

● Learn more● Keep it simple● Think about attack vectors● Prioritise vulnerabilities

● Be the “threat”● What do you want?

○ Personal data (name, address, DOB)○ Sensitive data (credit cards, bank accounts)○ Cause disruption (downtime)

● How would you do it?

Think Differently

Threat Modelling

● Damage● Reproducibility● Exploitability● Affected users● Discoverability

Authentication& Authorization

Authentication

== Verifying IDENTITY

● Password● Delegated password (LDAP etc.)● One-time code (SMS, Yubi, Google 2FA

etc.)● Biometrics (fingerprints, iris, DNA etc.)● Keycards / USB sticks etc.

CRYPTOGRAPHYIS

HARD

CRYPTOGRAPHYIS

HARDNEVER EVER “ROLL YOUR OWN”

CRYPTOGRAPHYIS

HARDNEVER EVER “ROLL YOUR OWN”

EVER!!!

Case Study: Custom Authentication

We thought about doing this…

Case Study: Custom Authentication

We thought about doing this…

Case Study: Custom Authentication

We thought about doing this…

...but the we realised we wereovercomplicating things.

Password Hashing

● Never store plain text passwords● Never encrypt passwords● Always hash passwords● Use password_hash / password_verify

○ >= PHP 5.5○ < PHP 5.5, use ircmaxell/password-compat

Authorization

== Verifying ACCESS

● Access lists● Role-based● Attribute-based

Linux Server Security

SSH Fortress

● Passwordless● Rootless● Lock down IP● Run on different port

Firewalls#!/bin/bash

IPT="/sbin/iptables"

$IPT --flush

$IPT --delete-chain

$IPT -P INPUT DROP

$IPT -P FORWARD DROP

$IPT -P OUTPUT DROP

# Loopback

$IPT -A INPUT -i lo -j ACCEPT

$IPT -A OUTPUT -o lo -j ACCEPT

# Inbound traffic

$IPT -A INPUT -p tcp --dport ssh -j

ACCEPT

$IPT -A INPUT -p tcp --dport 80 -j ACCEPT

# Outbound traffic

$IPT -A OUTPUT -p tcp --dport 80 -j

ACCEPT

$IPT -A OUTPUT -p udp --dport 53 -m state

--state NEW -j ACCEPT

Brute Force Attacks

● iptables (complex)● fail2ban● DenyHosts

Install Only What You Need

● Audit Regularly● Use provisioning● Don’t install cruft

Case Study: Be Minimal

Internets

Postfix

Squid Proxy(badly configured)

hacker

spam

Resources

● http://securingphp.com/● https://www.owasp.org/● http://blog.ircmaxell.com/

The Golden Rules

1. Keep it simple2. Know the risks3. Fail securely4. Don’t reinvent the wheel5. Never trust anything / anyone

If you follow all this, you get...

If you follow all this, you get...

Questions?

James Titcumbwww.jamestitcumb.comwww.protected.co.ukwww.phphants.co.uk@asgrim

Thanks for watching!